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Abstract 

Quantum key distribution based on encoding in three dimensional systems in the presence of several 
eavesdroppers is proposed. This extends the BB84 protocol in the presence of many eavesdroppers 
where two- level quantum systems (qubits) are replaced by three-level systems (qutrits). We discuss 
the scenarios involving two, three and four complementary bases. We derive the explicit form of Alice 
and Bob mutual information and the information gained by each eavesdropper. In particular, we show 
that, in the presence of only one eavesdropper, the protocol involving four bases is safer than the other 
ones. However, for two eavesdroppers, the security is strongly dependent on the attack probabilities. 
The effect of a large number of eavesdroppers is also investigated. 
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1 Introduction 



Inspired by Wiesner's ideas pQ, Bennett and Brassard proposed in 1984 [2| a new approach to 
cryptography by developing a key distribution protocol , now known as BB84. Since then Quantum 
Key Distribution (QKD) constitutes one the most investigated concept in the quantum information 
theory. QKD provides a scheme to ensure a secure communication between two legitimate parties 
(usually called Alice and Bob) using quantum states that belong to non compatible bases. Quantum 
mechanics ensures that in quantum cryptographic protocols, the presence of an eavesdropper (often 
called Eve) in the communication channel can be detected through disturbances to the transmitted 
message. In the BB84 protocol [2], Alice and Bob randomly choose between two complementary bases 
and the information of each basis is encoded using the orthogonal states of a two dimensional quantum 
system. This protocol was extended in different ways. The first extension was proposed in [3]-[I] by 
adding an extra basis that is mutually unbiased compared to the other two in a two dimensional 
system. Cryptographic schemes, extending the BB84 model, based on d level quantum systems with 
M mutually unbiased bases were also developed. In this sense, a protocol using d = 4 states and 
M = 2 bases was studied in [5] and the case of d = 3 states and M = 4 bases was presented in [6]. 
This provided a way to formulate a generalized quantum key distribution involving quantum systems 
with arbitrary dimension d and using M mutually complementary bases [7]- [8]. 

The main task of quantum protocols, mentioned above as well as many others proposed in the 
literature, is traditionally to provide secure communications against only one eavesdropper. Recently, 
in [9], the authors discussed a scenario involving several eavesdroppers. This extends the BB84 protocol 
to take into account the effects induced by many potential eavesdroppers. In this paper, we replace, 
in the model introduced in [9], the two-level quantum systems (qubits) by optical biphoton qutrits. 
At this stage, it is important to note that three level optical systems constitute promising objects of 
modern quantum information and quantum cryptography. Indeed, the realization of optical qutrits 
with light has been approached using the polarization states of two indistinguishable photons -a 
biphoton [TO] and their experimental manipulation was discussed in [TT]. Also, quantum encoding 
based on polarization states of a biphoton was examined in [12J. 

To investigate quantum key distribution based on a three level optical system, we shall first develop, 
in the second section, a method to construct the phase states of a biphoton-system and we define the 
discrete operations generating four mutually unbiased bases from which Alice can choose to encode 
her message. A second facet of this work concerns the mutual information between Alice and Bob and 
the information intercepted by the eavesdroppers which employ the intercept-resend strategy. The 
explicit expressions of mutual informations as well as quantum errors are given, in the third section, in 
terms of the number N of eavesdroppers, the attack probabilities and the number M of complementary 
bases used by the sender to encode her message. In the last section, analysis of the security of the 
model in the particular cases of N = 1 and N = 2 are presented. We also discuss the case where 
the N eavesdroppers are collaborating (all intercept the sent message with identical probabilities). 



2 



Concluding remarks close this paper. 



2 Qutrits, Phase states and mutually unbiased bases 
2.1 Phase states 

The biphoton qutrits are considered as superpositions of the three dimensional Fock space correspond- 
ing to the three possibilities of distributing two indistinguishable photons in two polarization modes 
horizontal (h) and vertical (v). The Fock space of purely polarized biphoton states is defined by 

T = {\n h ,n v ) , n h + n v = 2} (1) 

where |n^,n„) is a Fock representation of (n v ) horizontally (vertically) polarized photons. They 
are given by 



n h ,n v )= v ^ |00). (2) 



/n/J \fn 

The vector |0, 0) is the vacuum state and the objects af and a+ are the creation operators of photons 
with horizontal and vertical polarizations (with given equal frequencies and given identical propagation 
directions). The annihilation operators are defined as usual (a^ = (d^)',a~ = (a^y). 
To introduce the phase states, we first define the unitary phase operator as in [13] 

£=|2,0>(0,2| + |1,1)(2,0| + |0,2)(1,1|. (3) 

It is unitary. To find the phase states corresponding to this three level system, let us consider the 
eigenvalue equation 

E\z)=z\z), zeC. (4) 

By expanding the state \z) as a linear combination of the vector states of J 7 , it is easy to see that the 
eigenvalue z is given by 

z = q m = exp f i— — J with m = 0, 1, 2, (5) 
and the normalized eigenstates of the operator E (the phase states) rewrite 

|m) = -^(|0,2)+g m |l,l) + g 2m |2,0)). (6) 
It follows that the states \m) satisfy 

E\m) = e i6 ™\m) 9 m = ^, (7) 

which shows that they are indeed phase states and E is a unitary phase operator. The phase states 
are orthonormal ({m'\ to}/ — $Tn l rri) m Then, Alice encodes her message in the computational basis 
generating the Fock space T or in the phase states basis {\m) , m = 0, 1,2}. It is important to note 
that Alice can use two others bases which can be generated from the phase states as shown in what 
follows. 
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2.2 Mutually unbiased bases 

Recall that two d-dimensional bases are said to be unbiased if and only if the modulus of the inner 
product of any vector of one basis with any vector of the other one is equal to 1/y/d [H]-[I1]. The 
number M of mutually unbiased bases (MUBs) is such that M < d + 1. The maximum number 
M = d + 1 can be achieved when d is prime or a power of a prime |15j . Construction of MUBs 
associated with finite dimensional Hilbert space was considered via different methods as for instance 
ones based on discrete Fourier analysis over Galois fields and Galois rings, generalized Pauli matrices, 
angular momentum theory, etc ( for a recent review and other methods of MUBs construction see |16|). 
Accordingly, the three level optical system we are considering, has four mutually unbiased bases. The 
first basis is the computational basis B3 := {|2,0) , |1, 1) , |0, 2)} and the second one is generated by 
the phase states ([6]). Indeed, it is easy to check that the states ([6]) are unbiased to the computational 
basis . The two other remaining mutually unbiased bases can be generated as follows. We introduce 
the time evolution operator U (t) defined by 

U(t)\n h ,n v ) = e^i^'K^} (8) 

in term of vertical and horizontal ladder operators. The operator U(t) generates MUBs when acting 
on the phase states ([6]). Indeed, for the discrete values 

PIT 

t := t p = — with p = 0, 1, 2, 

the states ([6]) transform as 

U(t p )\m) := \p,m) = -J=(|0, 2) + q m +*>\l, 1) + q 2m+ P\2, 0». (9) 

Notice that for p = 0, the states |0, m) coincide with phase states © (|0, m) = \m)). It is simply verified 
that the computational basis B3 and the bases B p = {\p, m)} (p = 0, 1,2) are mutually unbiased. To 
close this section, it is important to note that the operator U (t p ) is related to the quadratic discrete 
Fourier transform [IB] and coincides with the so-called tritter |17] which is a generalization, in three 
dimensional case, of the 2x2 unitary operation characterizing a 50-50 beam splitter. 

3 Eavesdropping strategy and mutual informations 

As mentioned above, quantum key distribution in the presence of several eavesdroppers was developed 
in This scenario extends the BB84 protocol by investigating the effect of several eavesdropper 
intercept-resend attacks on the quantum error and mutual information between two legitimate parties. 
It was shown that the secured-unsecured transition depends strongly on the number of eavesdroppers 
and their probabilities of intercepting attacks. In this section, we investigate the effect of several 
eavesdroppers on the quantum cryptographic scheme using biphoton qutrits. 
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3.1 Eavesdropping strategy: the Model 

Following the idea discussed by Bourenanne et al [TJ, we consider a protocol with M (2 < M < 4) 
mutually complementary bases and 3 orthogonal states in each base. We shall assume that this 
protocol is under attack by an arbitrary number N of eavesdroppers E\ , E2 , E^. Within this 
protocol, Alice first selects randomly one of the M bases in which she wants to encode her state 
and second decides which of the 3 optical states (|0,2),|1,1) or 1 2, 0) ) to send. In other words, she 
sends to Bob random states in which the number of horizontally polarized photons is 0,1,2 with 
equal probability of 1/3. Bob measures each symbol sent by selecting at random between the M 
bases. Hence, the mutual information between Alice and Bob can be described by a joint probability 
P(xa, %b)- The random variables xa = 0, 1, 2 and xb = 0, 1, 2 represent the number of horizontally 
polarized photons prepared by the sender (Alice) and the measurement results obtained by the receiver 
(Bob). Between them a number N of eavesdropper Ei (i = 1,...,N) are trying to intercept the sent 
message. Each eavesdropper E{ intercepts, with probability Wj, the biphoton state emitted by the 
eavesdropper E^\. He or she measures its number of photons horizontally polarized by selecting at 
random, with probability 1/M, between the M MUBs and resends it, in its measured state, to the 
eavesdropper Ei + \. At the place of the non measured biphoton polarization, with probability 1 — Wj, 
the eavesdropper Ei sends randomly 0, 1,2, with equal probability 1/3, to the eavesdropper Ei + \. In 
the same way, the eavesdropper Ei + \ intercepts, with probability Wj+i, the biphoton state emitted by 
the eavesdropper Ei, measures its number of photons polarized horizontally by selecting at random, 
with probability 1/M, between the M MUBs, and resends it in its measured state to the eavesdropper 
Ei + 2 and so on. We note that the eavesdropper E\ intercepts the state emitted by Alice and the 
eavesdropper En resends the biphoton to Bob. 

Finally, in order to obtain a secret key, Alice and Bob use an authenticated public channel to 
estimate the error rate and the maximal quantity of information obtained by the eavesdroppers. 
However, if the error rate (called the error probability) is greater than a critical value (quantum error) 
Alice and Bob begin another protocol to establish another secret key until the error rate becomes 
smaller than the quantum error. 

3.2 The mutual informations 

To evaluate the mutual information between Alice and Bob and the amount of information gained by 
the eavesdroppers, the relevant information is the Shannon information of the sifted symbols, i.e., the 
symbols for which Alice and Bob have used the same bases. This information is measured in bits for 
simplicity. 

Let us denote by p(x) the prior probability for Alice to send the symbol x and p(x\y) is the posteriori 
probability that is the conditional probability of the sending party having sent the symbol x and the 
receiver (Bob or Eves) measured the result y. The mutual information is (see for instance (7J) 

I AY = log 2 3 - impost (10) 
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where Y stands for B, Ei, E%, ■ ■ ■ , E^ and the quantity 

-ffapost = - J }2p{y)^2p{x\y)log 2 p(x\y) 



fill 



is the aposteriori entropy. Using the symmetry properties of the protocol, it is easy to check that 

2 

I ay = log 2 3+ P(n h \0)log 2 p(n h \0). (12) 

n h =0 

The mutual information between Alice and Bob Iab and between Alice and the m-th eavesdropper 
lAE m (jn = 1)2,- •• ,N) are expressed in terms of the conditional probabilities which can be easily 
evaluated in terms of the attack probabilities using the eavesdropping strategy discussed above. 
Using the expression (I12p . we can hence obtain the mutual information between Alice and Bob 

i-p AB (o\oy 



Iab = log 2 3 + Pab(0|0) log 2 (P AB (0|0)) + [1 - P A b(0|0)] log 2 



(13) 



in term of the conditional probability Pab (0|0) . Based on the assumptions defining the eavesdropping 
strategy, one can show that this probability takes the following form 

N 

p AB (o\o) = J2 a k( N ) n k( N ) ( 14 ) 



where the coefficients aj-(iV) are given by 



a k (N) 



1 



M N ~ k 



k=0 



N-k-l 
M-l y ^ 

3 ^ 

i=0 



and the quantities Clk(N) are expressed in term of eavesdroppers attack probabilities as 



fik(JV) =uj 1 u;2---Un ^2 



«l<«2<---<«fc 



1 - LOi-t 1 - U>i 



1 — U). 



(15) 



(16) 



for k 7^ and the indices ij take the values 1, • • • ,N. For k = 0, 

fi (N) = UJ\U)2 ■ ■ ■ ujn- (17) 

Similarly, using equation (|12p . it is simple to show that the direct reconciliation information be- 
tween Alice and the m-th eavesdropper is given by 

"1-P^ ra (0|0) 



lAE m = log 2 3 + P AEm (0\0) log 2 (P ABm (0|0)) + [1 - P A E m (0\0)] log 2 



where 



PAE m W) 



1 - U3 r . 



m—1 



+ a k {m)VL k (m) 



(18) 



(19) 



k=0 



The lost information between the honest parties Alice and Bob corresponds to the maximum 
information intercepted by the entire eavesdroppers. This is given by 



Iae = Max ^IaEi > Iae 2 >■■■■> -^AEjv-i > Iae n J ■ 



(20) 
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The error rate or the error probability P err is defined by 



E 



x A ,x B 



Pab{xa/x b ) 



U!i=0 



Pab{xa/x b ) 



(21) 



The quantum error Q err is the value of the error probability P err for which Iab = Iae ■ It follows 
that for P err < Qerr we have Iae < Iab, while for P err > Q crr we have Iae > Iab- 

4 Results and discussion 

As illustration of the analysis developed in the previous section, we investigate in what follows the 
security of the protocol based on optical qutrit states in the presence of several eavesdroppers, in some 
particular cases. 



Similarly from equation (|19p . one obtains 



/ , x 1-w 1 / M-V 
P, E (0|0) = — + -! + —,.,. 



4.1 One eavesdropper and mutual informations 

In the situation where only one eavesdropper is trying to intercept the message sent by Alice {u\ = u), 
the equation (JT3]) gives 

PabW) = ^ (l + + (1 - a;). (22) 



(23) 



Reporting the conditional probabilities (|22j) and (|23|) in the equations (|T3j) and (jloj) . respectively, 
one has the mutual information Iab and Iae- The behavior of Iab and Iae as function of the attack 
probability u are plotted in the figure l.a. 
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M=2,d=3 



0,0 0,2 0,4 0,6 0,8 1,0 

The attack probability a 

FIG. l.a: Mutual information Iab and Iae as a function of the attack probability uj for qubits and 

qutrits. 

As expected, the mutual information between Alice and Bob and the amount of information inter- 
cepted by Eve coincide for uj = 1. In figure l.a, we also plotted the mutual information Iab and Iae 
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when the sender uses a two dimensional system with two or three mutually unbiased bases to encode 
her message. The explicit expressions of Iab and Iae are given in the appendix. They are computed 
similarly to ones derived in the previous section for a three level system. This helps us to compare the 
amount of mutual information when Alice uses qubits or qutrits as it shown in the figure l.a. Note 
that the obtained mutual information for d = 2 and M = 2 are in agreement with the results derived 
in [9]. 

To examine the security of the protocol, we studied the mutual information between the legitimate 
parties Alice and Bob Iab and lost information Iae as function of the error probability (Figure l.b). 




— i — i — i — i — i — i — i — i — i — i — i — i — i — i — |— 

0,00 0,05 0,10 0,15 0,20 0,25 0,30 0,35 



Error Probability 

FIG. l.b: Mutual information Iab and Iae as a function of quantum error Q err for qubits and qutrits. 

In this figure, we give the behavior of Iab and Iae for d = 3 when Alice chooses to encode her 
message using two, three or four complementary bases in the presence of only one eavesdropper. We 
evaluate the quantum error for each case. The results are summarized in table 1. In figure l.b, we 
also present the information Iab and Iae for qubits (d = 2) as a function of error probability. This is 
useful in order to compare our results with ones obtained within the BB84 protocol and the protocol 
involving qubits with six states (M = 3) ( see [3] and [1]). In this particular case, we evaluate the 
quantum error for M = 2 and M = 3. The results are given in table 1. It is clear from the figure as 
well as the table 1 that the protocol using (d = 2) with (M = 3) appears to provide better security. 
It is also important to stress that the quantum error in the case d = 3 and M = 4 provides the 
same quantum error as in the BB84 protocol. This shows that in a protocol involving three level 
systems, Alice should use four mutually unbiased bases to ensure the security of her sent information. 
It must be noticed that for d fixed, the quantum error increases with increasing values of the number 
of mutually unbiased bases M. In this respect, Alice must encode her message using all the available 
mutually unbiased bases to minimize the eavesdropping effects. 
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M 


2 


3 


4 


d = 3 


0.167 


0.222 


0.250 


d = 2 


0.25 


0.335 





Table 1: Quantum error for two and three level systems. 
4.2 Two eavesdroppers and mutual information 

Now, we consider the situation where two eavesdroppers E\ and E2 attack with probabilities oj\ and 
UJ2, respectively. In this case, the equation (fl~4"j) takes the simple form 

Pab(0\0) = ^fl+Ml^\ Ul0j2+ ^(i + ^l\ ^(l-waJ+Cl-wiJwaVci-wiJCl-wz). (24) 



Similarly, from equations (|19p . one has 



1 f M 2 — 1 



and 



1 ~~ °° 2 _u J_ 

M 2 



Pae 2 {0\Q) = + — ( 1 + "' „ >■ + T7 i I + 



M 2 -r 



1 

3 ' M 2 V" ' 3 j-*-* • m\~ ' 3 
Substituting ([24")) into (fT3|) . one gets the mutual information I^g between Alice and Bob. The condi- 
tional probabilities (I25p and ()26[) together with the equations (I18p and (I20p give the lost information 
to the eavesdropper, Iae- The figure 2. a represents the mutual information Iab and Iae (for d = 3 
and M = 2) as function of the attack probability oj\ of the first eavesdropper for different values of 
the attack probability of the second eavesdropper. 



M-l 



"1 - u)i)u 2 ■ 



(25) 



(26) 




0,6 0,8 



FIG. 2. a: Mutual information Iab and Iae as a function of the attack probability uj\ for different values 

Of Ul2- 

It clear that Iab and Iae depend strongly on the values u)\ and L02 and the mutual information 
between the legitimate parties decreases as u\ and L02 increase. The limiting case UJ2 = corresponds 
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to the protocol involving only one eavesdropper. In this case, the amount of information gained by 
the eavesdropper increases to intercept the information exchanged by Alice and Bob at u)\ = 1. But, 
when cl>2 7^ 0, the information intercepted by the eavesdroppers intersect Iab for witr — 0.92 when 
0J2 = 0.25 and for uji tT — 0.76 when L02 = 0.75. Hence, for 00% > witr, the amount of information lost 
becomes greater that one exchanged between Alice and Bob and occurs at the transition from the 
secured to unsecured phase. 

To understand the security of quantum key distribution based on qutrits in presence of two eaves- 
droppers, we studied the transition between the secured and unsecured phases. We note that in the 
secured phase, the error probability is smaller than the quantum error, while in the no secured phase 
the error probability is greater than the quantum error. At the transition line, the error probability 
coincides with the quantum error. Phase diagram, in the space parameter (wi, 0*2)5 is presented in the 
figure 2.b. This shows the transition line between secured and no secured phases. In contrast to the 
case of the protocol with one eavesdropper for which the secured-unsecured transition occurs at an 
intercept probability o>i = 1, the region of secured phase depends on both intercept probability rates 
coi and 0*2. We consider the situations where Alice uses two, three and four mutually bases. 

From figure 2.b, it is easily seen that for < uj\ < 0.55, the line transition between the secured 
and unsecured phase is 02-independent. It is also independent of the number of mutually independent 
bases M used by Alice. This changes drastically when the probability attack of the eavesdropper 
Ei becomes grater than 0.55. In this case, the transition depends strongly on the values of attacks 
probability of the second eavesdropper as well as the mutually unbiased bases M. The transition 
probability, at the transition line, increases with decreasing 002 

1,0- 

M= 

0,8 - 
0,6 - 
S "o,4- 
0,2 - 
0,0 - 

0,0 0,2 0,4 0.6 0.8 1.0 

FIG. 2.b: The (0*1,02) phase diagram for qutrits. 

To clarify the behavior of the transition from the secured to unsecured phase for 0.55 < o>i < 1, 
we give the figure 2.c where the line transition is represented for M = 2, M = 3 and M = 4. From 
this figure, one can see that for 0.55 < o*i < 0.67, the protocol involving M = 4 complementary bases 
gives less security than the two others using two and three bases. This situation becomes different in 
the region 0.67 < o*i < 0.86; Indeed, in this case the model with M = 3 provides less security. Finally, 
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for u)\ > 0.86, when Alice uses only two complementary bases, the area of secured phase is reduced in 
comparison to ones corresponding to the secured phases obtained with M = 3 and M = 4. 




FIG. 2.c: The (wi,^) phase diagram for 0.55 < w\ < 1. 



4.3 Many eavesdroppers 



Now, we shall discuss the situation where the eavesdroppers communicate between them and try to 
intercept the same state with identical probability cjj = oj for 7 = 1,2,--- ,N. In this case, the equation 
(|14p takes the simple form 

^ ' ' (27) 



Pab(0/0) = 1 + 1 



1 + F d-M) 



and the equation (fT9|) gives 



^(0/0) -i + §£ 



Co' 



1 + — (1 — M) 



m— 1 



(28) 



The (oj, iV)-phase diagram (Figure 3. a) shows the secured-unsecured transition when the N eaves- 
droppers are collaborating and attack with the same probability oj. 



1200 -, 




0,0 0,2 0,4 0,6 0,8 1,0 

The attack Probability ro 



FIG. 3a: The (oj, A r )-phase diagram. 
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The security of the protocol decreases when N increases. Moreover, in the region (0.1 < cj < 
1, < N < 50), the security of the protocol is completely independent of the number M of mutually 
unbiased bases used by the sender. However, for N > 50 and < uj < 0.1 (see figure 3.b), more 
security is provided by the protocol involving two complementary bases (i.e., M = 2). 




0,02 0,04 0,06 

The attack Probabilty co 



FIG. 3b: The (w, iV)-phase diagram. 



5 Concluding remarks 

We have considered quantum cryptographic scheme where bi-photon qutrits are used to encode the 
information. Using the Pegg-Barnett phase operator, we defined the four mutually unbiased bases 
of this three level system. This is mainly based on the phase states approach. To compare the 
qutrits based cryptographic protocols with their qubits based counterpart, we also investigated the 
bi-dimensional quantum systems when the sender uses two or three bases in the presence of many 
eavesdroppers. In the situation where only one eavesdropper is involved, for a two level quantum 
system, the protocol based on three complementary bases is safer than the BB84 one which uses two 
bases only. We have shown that when Alice and Bob exchange information using qutrits, the safer 
scenario corresponds to one using four mutually unbiased bases. It follows that for d = 2 as well as 
d = 3, to ensure the security of the sent information, Alice should encode her message using all the 
available complementary bases of the Hilbert space of the quantum system under consideration. It 
is important to note that the quantum error for the scheme involving four mutually unbiased bases 
coincides with the one obtained in BB84 protocol. It seems that for higher dimensional quantum 
systems, the maximal security is reached when the sender uses all available complementary bases. 
These results change drastically when more than one eavesdropper attempt to intercept the information 
exchanged between the legitimate parties. Indeed, the secured-unsecured transition for qutrits is 
strongly dependent on the attack probabilities uj\ and 0J2- In this case many scenarios are possible 
and there is a concurrence between the protocols involving two, three or four mutually unbiased 
bases. Finally, we have shown that the number of the eavesdroppers reduces the area of secured phase 
and the protocol becomes less secure. In particular, we examined the case where a large number of 
collaborating eavesdroppers are trying to intercept the information with equal probability u. This 
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shows clearly that the number of eavesdroppers is very important in dealing with the security of any 
quantum cryptographic key distribution protocol . 
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Appendix 

It is well known that for a two dimensional quantum system, there is three maximally unbiased 
bases from which Alice can choose M = 2 or M = 3 bases to encode her message. Similarly to the 
qutrits case discussed above and using the same assumptions, the mutual information between Alice 
and Bob, in presence of one eavesdropper only, can be found as 



I AB = 1 + P AB (0\0) log 2 (P AB (0\0)) + [1 - P AB (P\0)] log 2 



1-P AB {0\0) 



where 



Pab(0\0) = 1 



uM-1 
2 M ' 



The intercepted information by the eavesdropper is 



where 



Iae(0\0) = 1 + Pae(0\0) log 2 (P j4 i?(0|0)) + [1 - Pae(0\0)] log 2 



1 ( w 
PAE = 2 1+ M 



1 - P AE (0\0) 



For two eavesdroppers E\ and E2, trying to intercept the sent information with probabilities oj\ and 
UJ2, the conditional probabilities are given by 



M - 1 (M - l) 2 

*Ub(0|0) = 1 - ^tt^K + w 2 ) + oa , 9 



2M 



2M 2 



PaeA0\0) 



1 - wi(l - 0J2) + 



bj x ^2 



and 



Pae 2 (0\0) = 



1 



lo 2 M - 1 
1 + M ~ -M 2 -^ 2 



from which one can evaluate the mutual informations Iab, Iae x and Iae 2 - 
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